@prestack/thread 0.1.3 → 0.1.5

package/dist/integrity/slopnators/sl_undeclared_operation.ts

@@ -21,14 +21,137 @@ function declared(): ReadonlySet<string> {
       const where = one.at?.split('\\').join('/')
       if (where === undefined || !where.includes(UNDER)) continue
       if (one.id !== undefined) found.add(one.id)
-      const named = where.split('/').at(-1)?.replace(/\.[^.]+$/, '')
-      if (named !== undefined) found.add(named)
     }
   }
 
   return found
 }
 
+function bodies(): ReadonlySet<string> {
+  const found = new Set<string>()
+
+  descend()
+
+  for (const at of reached()) {
+    const text = read(at)
+    if (text === undefined) continue
+
+    for (const one of rowsIn(text)) {
+      const where = one.at?.split('\\').join('/')
+      if (where === undefined || !where.includes(UNDER)) continue
+      if (one.id !== undefined) found.add(where.replace(/\.[^./]+$/, ''))
+    }
+  }
+
+  return found
+}
+
+function declaring(): ReadonlySet<string> {
+  const found = new Set<string>()
+
+  descend()
+
+  for (const at of reached()) {
+    const text = read(at)
+    if (text === undefined) continue
+
+    for (const one of rowsIn(text)) {
+      const where = one.at?.split('\\').join('/')
+      if (where === undefined) continue
+      found.add(where.replace(/\.[^./]+$/, ''))
+    }
+  }
+
+  return found
+}
+
+interface Imported {
+  readonly type?: string
+  readonly source?: { readonly value?: unknown }
+  readonly specifiers?: readonly { readonly local?: { readonly name?: unknown } }[]
+}
+
+function importedFrom(name: string, ancestors: readonly unknown[]): string | undefined {
+  const program = ancestors.find((one) => (one as { readonly type?: string } | undefined)?.type === 'Program') as
+    | { readonly body?: readonly Imported[] }
+    | undefined
+  for (const one of program?.body ?? []) {
+    if (one.type !== 'ImportDeclaration' || typeof one.source?.value !== 'string') continue
+    if (!(one.specifiers ?? []).some((each) => each.local?.name === name)) continue
+    return one.source.value
+  }
+  return undefined
+}
+
+interface Typed {
+  readonly typeName?: { readonly name?: unknown }
+  readonly typeAnnotation?: Typed
+  readonly types?: readonly Typed[]
+}
+
+interface Annotated {
+  readonly type?: string
+  readonly name?: unknown
+  readonly typeAnnotation?: Typed
+}
+
+interface Held {
+  readonly type?: string
+  readonly params?: readonly Annotated[]
+  readonly body?: unknown
+}
+
+function namedIn(said: Typed | undefined): string | undefined {
+  if (said === undefined) return undefined
+  if (typeof said.typeName?.name === 'string') return said.typeName.name
+  const inner = namedIn(said.typeAnnotation)
+  if (inner !== undefined) return inner
+  for (const one of said.types ?? []) {
+    const found = namedIn(one)
+    if (found !== undefined) return found
+  }
+  return undefined
+}
+
+const typeNamed = (held: Annotated | undefined): string | undefined => namedIn(held?.typeAnnotation?.typeAnnotation)
+
+interface Stated {
+  readonly type?: string
+  readonly declarations?: readonly { readonly id?: Annotated }[]
+}
+
+function annotating(name: string, ancestors: readonly unknown[]): string | undefined {
+  for (const held of ancestors) {
+    for (const param of (held as Held).params ?? []) {
+      if (param.type !== 'Identifier' || param.name !== name) continue
+      const said = typeNamed(param)
+      if (said !== undefined) return said
+    }
+
+    const body = (held as Held).body
+    for (const one of Array.isArray(body) ? (body as readonly Stated[]) : []) {
+      if (one.type !== 'VariableDeclaration') continue
+      for (const each of one.declarations ?? []) {
+        if (each.id?.type !== 'Identifier' || each.id.name !== name) continue
+        const said = typeNamed(each.id)
+        if (said !== undefined) return said
+      }
+    }
+  }
+  return undefined
+}
+
+const settled = (from: string, source: string): string => {
+  if (!source.startsWith('.')) return source.replace(/\.[^./]+$/, '')
+  const parts = from.split('/').slice(0, -1)
+  for (const step of source.replace(/\.[^./]+$/, '').split('/')) {
+    if (step === '.' || step === '') continue
+    if (step === '..') parts.pop()
+    else parts.push(step)
+  }
+  return parts.join('/')
+}
+
 interface Called {
   readonly callee?: { readonly type?: string; readonly name?: string; readonly property?: { readonly type?: string; readonly name?: string } }
   readonly arguments?: readonly { readonly type?: string; readonly value?: unknown; readonly name?: string }[]
@@ -36,7 +159,7 @@ interface Called {
 
 export const slopnator: Slopnator = {
   on: ['CallExpression'],
-  holds: (node) => {
+  holds: (node, at) => {
     const call = node as Called | undefined
     const callee = call?.callee
     const named =
@@ -55,34 +178,19 @@ export const slopnator: Slopnator = {
       )
     }
 
-    /*
-     * THE OPERATION ITSELF IS A BETTER ANSWER THAN ITS NAME, AND THIS USED TO REFUSE IT.
-     *
-     * This asked for a string literal and refused everything else, which was right when the only
-     * caller was a UI seam handed a bare name. It has been wrong since dispatch stopped taking one:
-     * the note above says so in as many words — "`dispatch` in packages/core/operations/src/dispatch.ts
-     * takes an Operation object rather than a name". What ships now imports the compiled operation
-     * and hands over the binding, and a binding cannot be assembled at run time: if it named nothing,
-     * the file would not compile.
-     *
-     * Measured 2026-08-31 on a registry install: an operations-only app, everything made by the CLI,
-     * failed its own sweep on `operations/_client.ts` — a file its own generator had just written,
-     * naming an operation the same tree declares. The gate refuses the build now, so a law that
-     * refuses a generated file is an app that cannot ship.
-     *
-     * Narrow on purpose. An identifier is accepted only when it IS one of the declared operations,
-     * which is the shape the generators emit — `import { operation as wf_charge }` and then
-     * `dispatch(wf_charge, …)`. A variable holding a computed name is still refused, because it does
-     * not match a declaration, and that is the hole this law was written for.
-     */
     const all = declared()
 
     if (first.type === 'Identifier' && typeof first.name === 'string') {
       if (all.has(first.name)) return false
+      const source = importedFrom(first.name, at.ancestors())
+      if (source !== undefined && bodies().has(settled(at.filename, source))) return false
+      const named = annotating(first.name, at.ancestors())
+      const typed = named === undefined ? undefined : importedFrom(named, at.ancestors())
+      if (typed !== undefined && declaring().has(settled(at.filename, typed))) return false
       return (
-        `dispatch is handed \`${first.name}\`, and nothing declares an operation by that name. A binding is only ` +
-        'checkable when it is the operation — import the compiled operation and hand that over, so what runs and ' +
-        'what was declared are the same thing rather than two things that agree today'
+        `dispatch is handed \`${first.name}\`, and it is not imported from a file any row declares as an operation. ` +
+        'A binding is only checkable when it is the operation — import the compiled operation and hand that over, so ' +
+        'what runs and what was declared are the same thing rather than two things that agree today'
       )
     }
 

package/dist/integrity/slopnators/sl_undeclared_variant.js

@@ -1,5 +1,5 @@
-import { descend, read, reached } from "../../core/descend.js";
-import { rowsIn } from "./sl_unthreaded.js";
+import { descend, read, reached } from '../../core/descend.js';
+import { rowsIn } from './sl_unthreaded.js';
 const ELEMENT = 'element';
 const VARIANT = 'variant';
 function nameOf(id) {

package/dist/integrity/slopnators/sl_undeclared_webhook.d.ts

@@ -0,0 +1,2 @@
+import type { Slopnator } from '../slopnator.ts';
+export declare const slopnator: Slopnator;

package/dist/integrity/slopnators/sl_undeclared_webhook.js

@@ -0,0 +1,90 @@
+import ts from 'typescript';
+import { descend } from '../../core/descend.js';
+const said = (held) => held !== undefined && ts.isStringLiteral(held) ? held.text : undefined;
+const listed = (held) => held !== undefined && ts.isArrayLiteralExpression(held)
+    ? held.elements.filter((one) => ts.isStringLiteral(one)).map((one) => one.text)
+    : [];
+const yes = (held) => held !== undefined && held.kind === ts.SyntaxKind.TrueKeyword;
+function invoking(text) {
+    const file = ts.createSourceFile('row.ts', text, ts.ScriptTarget.Latest, true);
+    const rows = new Map();
+    const found = [];
+    const visit = (node) => {
+        if (ts.isObjectLiteralExpression(node)) {
+            const of = (name) => {
+                for (const one of node.properties) {
+                    if (ts.isPropertyAssignment(one) && ts.isIdentifier(one.name) && one.name.text === name)
+                        return one.initializer;
+                }
+                return undefined;
+            };
+            const id = said(of('id'));
+            if (id !== undefined)
+                rows.set(id, node);
+            const invokes = said(of('invokes'));
+            if (id !== undefined && invokes !== undefined) {
+                found.push({ id, invokes, carries: said(of('arrives')) !== undefined && listed(of('requires')).length > 0 });
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(file);
+    return { asking: found, rows };
+}
+const fieldOf = (node, name) => {
+    for (const one of node.properties) {
+        if (ts.isPropertyAssignment(one) && ts.isIdentifier(one.name) && one.name.text === name)
+            return one.initializer;
+    }
+    return undefined;
+};
+export const slopnator = {
+    holds: (_node, at) => {
+        const { asking, rows } = invoking(at.text);
+        if (asking.length === 0)
+            return false;
+        const found = [];
+        const pass = descend();
+        for (const one of asking) {
+            const here = rows.get(one.invokes);
+            const named = here === undefined ? undefined : listed(fieldOf(here, 'webhooks'));
+            const signs = here === undefined ? undefined : yes(fieldOf(here, 'signed'));
+            const runs = pass.stated.get(one.invokes);
+            if (here === undefined && runs === undefined) {
+                found.push(one.id + ' invokes ' + one.invokes + ', and nothing in this tree declares an operation by that name');
+                continue;
+            }
+            if (!(named ?? listed(runs?.fields.get('webhooks'))).includes(one.id)) {
+                found.push(one.id + ' invokes ' + one.invokes + ', and that operation names no webhook ' + one.id +
+                    ' back, so it is reachable from outside by something it never agreed to');
+            }
+            if ((signs ?? yes(runs?.fields.get('signed'))) && !one.carries) {
+                found.push(one.invokes + ' takes only a signed webhook, and ' + one.id +
+                    ' states no header a signature arrives on and no secret to check it against');
+            }
+        }
+        return found.length === 0 ? false : found.join('; ');
+    },
+    proves: {
+        wrong: [
+            {
+                files: [
+                    { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly invokes?: string\n  readonly webhooks?: readonly string[]\n  readonly declares?: readonly Threaded[]\n}\n" },
+                    { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    { at: 'threads/_probe_webhook.ts' },\n  ],\n}\n" },
+                    { at: 'threads/_probe_webhook.ts', source: "export const WEBHOOKS: Threaded = {\n  id: 'webhooks',\n  declares: [\n    { id: 'wh_stripe', at: 'app/inbound/wh_stripe/route.ts', invokes: 'wf_charge' },\n    { id: 'wf_charge', at: 'operations/wf_charge.ts' },\n  ],\n}\n" },
+                ],
+                at: 'threads/_probe_webhook.ts',
+            },
+        ],
+        right: [
+            {
+                files: [
+                    { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly version?: number\n  readonly invokes?: string\n  readonly webhooks?: readonly string[]\n  readonly by?: string\n  readonly runs?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n}\n" },
+                    { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    { at: 'threads/_probe_webhook.ts' },\n  ],\n}\n" },
+                    { at: 'threads/_probe_webhook.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const WEBHOOKS: Threaded = {\n  id: 'webhooks',\n  version: 1,\n  declares: [\n    { id: 'wf_charge', at: 'operations/wf_charge.ts', webhooks: ['wh_stripe'] },\n  ],\n  derives: [\n    { id: 'wh_stripe', at: 'app/inbound/wh_stripe/route.ts', invokes: 'wf_charge', by: 'thread capabilities', runs: 'thread capabilities --check' },\n  ],\n}\n" },
+                ],
+                at: 'threads/_probe_webhook.ts',
+            },
+        ],
+    },
+};

package/dist/integrity/slopnators/sl_undeclared_webhook.ts

@@ -0,0 +1,108 @@
+import ts from 'typescript'
+
+import { descend } from '../../core/descend.ts'
+
+import type { Slopnator } from '../slopnator.ts'
+
+const said = (held: ts.Expression | undefined): string | undefined =>
+  held !== undefined && ts.isStringLiteral(held) ? held.text : undefined
+
+const listed = (held: ts.Expression | undefined): readonly string[] =>
+  held !== undefined && ts.isArrayLiteralExpression(held)
+    ? held.elements.filter((one) => ts.isStringLiteral(one)).map((one) => (one as ts.StringLiteral).text)
+    : []
+
+const yes = (held: ts.Expression | undefined): boolean =>
+  held !== undefined && held.kind === ts.SyntaxKind.TrueKeyword
+
+interface Asking {
+  readonly id: string
+  readonly invokes: string
+  readonly carries: boolean
+}
+
+function invoking(text: string): { readonly asking: readonly Asking[]; readonly rows: ReadonlyMap<string, ts.ObjectLiteralExpression> } {
+  const file = ts.createSourceFile('row.ts', text, ts.ScriptTarget.Latest, true)
+  const rows = new Map<string, ts.ObjectLiteralExpression>()
+  const found: Asking[] = []
+  const visit = (node: ts.Node): void => {
+    if (ts.isObjectLiteralExpression(node)) {
+      const of = (name: string): ts.Expression | undefined => {
+        for (const one of node.properties) {
+          if (ts.isPropertyAssignment(one) && ts.isIdentifier(one.name) && one.name.text === name) return one.initializer
+        }
+        return undefined
+      }
+      const id = said(of('id'))
+      if (id !== undefined) rows.set(id, node)
+      const invokes = said(of('invokes'))
+      if (id !== undefined && invokes !== undefined) {
+        found.push({ id, invokes, carries: said(of('arrives')) !== undefined && listed(of('requires')).length > 0 })
+      }
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(file)
+  return { asking: found, rows }
+}
+
+const fieldOf = (node: ts.ObjectLiteralExpression, name: string): ts.Expression | undefined => {
+  for (const one of node.properties) {
+    if (ts.isPropertyAssignment(one) && ts.isIdentifier(one.name) && one.name.text === name) return one.initializer
+  }
+  return undefined
+}
+
+export const slopnator: Slopnator = {
+  holds: (_node, at) => {
+    const { asking, rows } = invoking(at.text)
+    if (asking.length === 0) return false
+    const found: string[] = []
+    const pass = descend()
+    for (const one of asking) {
+      const here = rows.get(one.invokes)
+      const named = here === undefined ? undefined : listed(fieldOf(here, 'webhooks'))
+      const signs = here === undefined ? undefined : yes(fieldOf(here, 'signed'))
+      const runs = pass.stated.get(one.invokes)
+      if (here === undefined && runs === undefined) {
+        found.push(one.id + ' invokes ' + one.invokes + ', and nothing in this tree declares an operation by that name')
+        continue
+      }
+      if (!(named ?? listed(runs?.fields.get('webhooks'))).includes(one.id)) {
+        found.push(
+          one.id + ' invokes ' + one.invokes + ', and that operation names no webhook ' + one.id +
+            ' back, so it is reachable from outside by something it never agreed to',
+        )
+      }
+      if ((signs ?? yes(runs?.fields.get('signed'))) && !one.carries) {
+        found.push(
+          one.invokes + ' takes only a signed webhook, and ' + one.id +
+            ' states no header a signature arrives on and no secret to check it against',
+        )
+      }
+    }
+    return found.length === 0 ? false : found.join('; ')
+  },
+  proves: {
+    wrong: [
+      {
+        files: [
+          { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly invokes?: string\n  readonly webhooks?: readonly string[]\n  readonly declares?: readonly Threaded[]\n}\n" },
+          { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    { at: 'threads/_probe_webhook.ts' },\n  ],\n}\n" },
+          { at: 'threads/_probe_webhook.ts', source: "export const WEBHOOKS: Threaded = {\n  id: 'webhooks',\n  declares: [\n    { id: 'wh_stripe', at: 'app/inbound/wh_stripe/route.ts', invokes: 'wf_charge' },\n    { id: 'wf_charge', at: 'operations/wf_charge.ts' },\n  ],\n}\n" },
+        ],
+        at: 'threads/_probe_webhook.ts',
+      },
+    ],
+    right: [
+      {
+        files: [
+          { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly version?: number\n  readonly invokes?: string\n  readonly webhooks?: readonly string[]\n  readonly by?: string\n  readonly runs?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n}\n" },
+          { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    { at: 'threads/_probe_webhook.ts' },\n  ],\n}\n" },
+          { at: 'threads/_probe_webhook.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const WEBHOOKS: Threaded = {\n  id: 'webhooks',\n  version: 1,\n  declares: [\n    { id: 'wf_charge', at: 'operations/wf_charge.ts', webhooks: ['wh_stripe'] },\n  ],\n  derives: [\n    { id: 'wh_stripe', at: 'app/inbound/wh_stripe/route.ts', invokes: 'wf_charge', by: 'thread capabilities', runs: 'thread capabilities --check' },\n  ],\n}\n" },
+        ],
+        at: 'threads/_probe_webhook.ts',
+      },
+    ],
+  },
+}

package/dist/integrity/slopnators/sl_underived_route.d.ts

@@ -0,0 +1,2 @@
+import type { Slopnator } from '../slopnator.ts';
+export declare const slopnator: Slopnator;

package/dist/integrity/slopnators/sl_underived_route.js

@@ -0,0 +1,61 @@
+import ts from 'typescript';
+import { LISTS as LINEAGE } from '../../core/descend.js';
+const LISTS = new Set(LINEAGE);
+const ROUTE = '/route.ts';
+const said = (held) => held !== undefined && ts.isStringLiteral(held) ? held.text : undefined;
+const fieldOf = (node, name) => {
+    for (const one of node.properties) {
+        if (ts.isPropertyAssignment(one) && ts.isIdentifier(one.name) && one.name.text === name)
+            return one.initializer;
+    }
+    return undefined;
+};
+export const slopnator = {
+    holds: (_node, at) => {
+        const file = ts.createSourceFile('row.ts', at.text, ts.ScriptTarget.Latest, true);
+        const routes = new Map();
+        const permitted = new Set();
+        const visit = (node) => {
+            if (ts.isPropertyAssignment(node) &&
+                ts.isIdentifier(node.name) &&
+                LISTS.has(node.name.text) &&
+                ts.isArrayLiteralExpression(node.initializer)) {
+                const list = node.name.text;
+                for (const one of node.initializer.elements) {
+                    if (!ts.isObjectLiteralExpression(one))
+                        continue;
+                    const where = said(fieldOf(one, 'at'));
+                    if (where === undefined || !where.endsWith(ROUTE))
+                        continue;
+                    routes.set(where, list);
+                    if (list === 'derives' && said(fieldOf(one, 'by')) !== undefined && said(fieldOf(one, 'runs')) !== undefined) {
+                        permitted.add(where);
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(file);
+        const found = [];
+        for (const [where, list] of routes) {
+            if (permitted.has(where))
+                continue;
+            found.push(where + ' is named by a ' + list + ' row' +
+                (list === 'derives' ? ' that states no by and no runs' : '') +
+                ', and a route is only ever derived');
+        }
+        return found.length === 0 ? false : found.join('; ');
+    },
+    proves: {
+        wrong: ["const M = { seeds: [{ at: 'app/inbound/wh_stripe/route.ts' }] }"],
+        right: [
+            {
+                files: [
+                    { at: 'threads/thread.ts', source: "export const THREAD = {\n  declares: [\n    { at: 'threads/_probe_route.ts' },\n  ],\n}\n" },
+                    { at: 'threads/_probe_route.ts', source: "export const M = {\n  derives: [\n    { at: 'app/inbound/wh_stripe/route.ts', by: 'thread capabilities', runs: 'thread capabilities --check' },\n  ],\n}\n" },
+                ],
+                at: 'threads/_probe_route.ts',
+            },
+        ],
+    },
+};

package/dist/integrity/slopnators/sl_underived_route.ts

@@ -0,0 +1,72 @@
+import ts from 'typescript'
+
+import { LISTS as LINEAGE } from '../../core/descend.ts'
+
+import type { Slopnator } from '../slopnator.ts'
+
+const LISTS: ReadonlySet<string> = new Set(LINEAGE)
+
+const ROUTE = '/route.ts'
+
+const said = (held: ts.Expression | undefined): string | undefined =>
+  held !== undefined && ts.isStringLiteral(held) ? held.text : undefined
+
+const fieldOf = (node: ts.ObjectLiteralExpression, name: string): ts.Expression | undefined => {
+  for (const one of node.properties) {
+    if (ts.isPropertyAssignment(one) && ts.isIdentifier(one.name) && one.name.text === name) return one.initializer
+  }
+  return undefined
+}
+
+export const slopnator: Slopnator = {
+  holds: (_node, at) => {
+    const file = ts.createSourceFile('row.ts', at.text, ts.ScriptTarget.Latest, true)
+    const routes = new Map<string, string>()
+    const permitted = new Set<string>()
+
+    const visit = (node: ts.Node): void => {
+      if (
+        ts.isPropertyAssignment(node) &&
+        ts.isIdentifier(node.name) &&
+        LISTS.has(node.name.text) &&
+        ts.isArrayLiteralExpression(node.initializer)
+      ) {
+        const list = node.name.text
+        for (const one of node.initializer.elements) {
+          if (!ts.isObjectLiteralExpression(one)) continue
+          const where = said(fieldOf(one, 'at'))
+          if (where === undefined || !where.endsWith(ROUTE)) continue
+          routes.set(where, list)
+          if (list === 'derives' && said(fieldOf(one, 'by')) !== undefined && said(fieldOf(one, 'runs')) !== undefined) {
+            permitted.add(where)
+          }
+        }
+      }
+      ts.forEachChild(node, visit)
+    }
+    visit(file)
+
+    const found: string[] = []
+    for (const [where, list] of routes) {
+      if (permitted.has(where)) continue
+      found.push(
+        where + ' is named by a ' + list + ' row' +
+          (list === 'derives' ? ' that states no by and no runs' : '') +
+          ', and a route is only ever derived',
+      )
+    }
+    return found.length === 0 ? false : found.join('; ')
+  },
+  proves: {
+    wrong: ["const M = { seeds: [{ at: 'app/inbound/wh_stripe/route.ts' }] }"],
+    right: [
+      {
+        files: [
+          { at: 'threads/thread.ts', source: "export const THREAD = {\n  declares: [\n    { at: 'threads/_probe_route.ts' },\n  ],\n}\n" },
+          { at: 'threads/_probe_route.ts', source: "export const M = {\n  derives: [\n    { at: 'app/inbound/wh_stripe/route.ts', by: 'thread capabilities', runs: 'thread capabilities --check' },\n  ],\n}\n" },
+        ],
+        at: 'threads/_probe_route.ts',
+      },
+    ],
+  },
+}

package/dist/integrity/slopnators/sl_ungoverned_island.js

@@ -1,5 +1,5 @@
-import { here, islandsDeclared } from "./sl_unthreaded.js";
-import { findTree } from "../../core/tree.js";
+import { here, islandsDeclared } from './sl_unthreaded.js';
+import { findTree } from '../../core/tree.js';
 const TREE = `${findTree().name}/`;
 const GOVERNS = /^\s*governs:\s*'([^']+)'/gm;
 export const slopnator = {
@@ -47,7 +47,7 @@ export const slopnator = {
                 files: [
                     {
                         at: 'threads/_governed_probe.ts',
-                        source: "export const M: Islanding = {\n  declares: [\n    { id: 'events', at: 'packages/core/spec/src/islands/events.ts', governs: ['app/_declare/events.ts'] },\n  ],\n}\n",
+                        source: "export const M: Islanding = {\n  declares: [\n    { id: 'events', at: 'packages/core/spec/src/islands/events.ts', governs: ['operations/'] },\n  ],\n}\n",
                     },
                 ],
                 at: 'threads/_governed_probe.ts',

package/dist/integrity/slopnators/sl_ungoverned_island.ts

@@ -50,7 +50,7 @@ export const slopnator: Slopnator = {
         files: [
           {
             at: 'threads/_governed_probe.ts',
-            source: "export const M: Islanding = {\n  declares: [\n    { id: 'events', at: 'packages/core/spec/src/islands/events.ts', governs: ['app/_declare/events.ts'] },\n  ],\n}\n",
+            source: "export const M: Islanding = {\n  declares: [\n    { id: 'events', at: 'packages/core/spec/src/islands/events.ts', governs: ['operations/'] },\n  ],\n}\n",
           },
         ],
         at: 'threads/_governed_probe.ts',

package/dist/integrity/slopnators/sl_unlisted_program.d.ts

@@ -0,0 +1,2 @@
+import type { Slopnator } from '../slopnator.ts';
+export declare const slopnator: Slopnator;

package/dist/integrity/slopnators/sl_unlisted_program.js

@@ -0,0 +1,39 @@
+import { ROOT } from '../../core/descend.js';
+import { valuesIn } from '../../core/rows.js';
+import { kind } from '../../integrations/disk.js';
+import { REACH, programOf, unlisted } from '../../integrations/target.js';
+const TARGETS = 'TARGETS';
+const there = (path) => kind(path) === 'file';
+export const slopnator = {
+    holds: (_node, at) => {
+        let held;
+        try {
+            held = valuesIn(at.text);
+        }
+        catch (thrown) {
+            if (!at.text.includes(TARGETS))
+                return false;
+            return 'this sheet names ' + TARGETS + ' and could not be read as values, so no target on it was checked — ' + (thrown instanceof Error ? thrown.message : String(thrown));
+        }
+        const found = [];
+        for (const one of held.TARGETS ?? []) {
+            if (typeof one.id !== 'string' || !one.id.startsWith(REACH.cli))
+                continue;
+            const name = one.id.slice(REACH.cli.length);
+            if (programOf(name, ROOT, there) === undefined)
+                found.push(unlisted(name));
+        }
+        return found.length === 0 ? false : found.join('. ');
+    },
+    proves: {
+        wrong: [
+            "export const TARGETS: readonly Target[] = [{ id: 'cli_bash', of: 'in_shell', describes: 'The shell on the machine a command runs on.', version: 1, takes: [], requires: [] }]",
+        ],
+        right: [
+            "export const TARGETS: readonly Target[] = [{ id: 'cli_tsc', of: 'in_typescript', describes: 'The compiler this tree is checked and built with.', version: 1, takes: [], requires: [] }]",
+            "export const TARGETS: readonly Target[] = [{ id: 'cli_packager', of: 'in_packager', describes: 'The package manager the lockfile beside this tree picks.', version: 1, takes: [], requires: [] }]",
+            "export const TARGETS: readonly Target[] = [{ id: 'cli_node', of: 'in_node', describes: 'The runtime this framework runs on.', version: 1, takes: [], requires: [] }]",
+            "export const TARGETS: readonly Target[] = [{ id: 'ht_registry', of: 'in_registry', describes: 'The registry every package goes to.', version: 1, takes: [], requires: [], address: 'https://registry.npmjs.org' }]",
+        ],
+    },
+};

package/dist/integrity/slopnators/sl_unlisted_program.ts

@@ -0,0 +1,40 @@
+import { ROOT } from '../../core/descend.ts'
+import { valuesIn } from '../../core/rows.ts'
+import { kind } from '../../integrations/disk.ts'
+import { REACH, programOf, unlisted } from '../../integrations/target.ts'
+
+import type { Slopnator } from '../slopnator.ts'
+
+const TARGETS = 'TARGETS'
+
+const there = (path: string): boolean => kind(path) === 'file'
+
+export const slopnator: Slopnator = {
+  holds: (_node, at) => {
+    let held: { readonly TARGETS?: readonly { readonly id?: unknown }[] }
+    try {
+      held = valuesIn(at.text) as { readonly TARGETS?: readonly { readonly id?: unknown }[] }
+    } catch (thrown) {
+      if (!at.text.includes(TARGETS)) return false
+      return 'this sheet names ' + TARGETS + ' and could not be read as values, so no target on it was checked — ' + (thrown instanceof Error ? thrown.message : String(thrown))
+    }
+    const found: string[] = []
+    for (const one of held.TARGETS ?? []) {
+      if (typeof one.id !== 'string' || !one.id.startsWith(REACH.cli)) continue
+      const name = one.id.slice(REACH.cli.length)
+      if (programOf(name, ROOT, there) === undefined) found.push(unlisted(name))
+    }
+    return found.length === 0 ? false : found.join('. ')
+  },
+  proves: {
+    wrong: [
+      "export const TARGETS: readonly Target[] = [{ id: 'cli_bash', of: 'in_shell', describes: 'The shell on the machine a command runs on.', version: 1, takes: [], requires: [] }]",
+    ],
+    right: [
+      "export const TARGETS: readonly Target[] = [{ id: 'cli_tsc', of: 'in_typescript', describes: 'The compiler this tree is checked and built with.', version: 1, takes: [], requires: [] }]",
+      "export const TARGETS: readonly Target[] = [{ id: 'cli_packager', of: 'in_packager', describes: 'The package manager the lockfile beside this tree picks.', version: 1, takes: [], requires: [] }]",
+      "export const TARGETS: readonly Target[] = [{ id: 'cli_node', of: 'in_node', describes: 'The runtime this framework runs on.', version: 1, takes: [], requires: [] }]",
+      "export const TARGETS: readonly Target[] = [{ id: 'ht_registry', of: 'in_registry', describes: 'The registry every package goes to.', version: 1, takes: [], requires: [], address: 'https://registry.npmjs.org' }]",
+    ],
+  },
+}

package/dist/integrity/slopnators/sl_unnamed_island.js

@@ -1,4 +1,4 @@
-import { declaresIsland, here, islandsDeclared } from "./sl_unthreaded.js";
+import { declaresIsland, here, islandsDeclared } from './sl_unthreaded.js';
 export const slopnator = {
     holds: (_node, at) => {
         const schema = declaresIsland(at.text);